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It's a jungle out 
there, but with some 
guidance, an intrepid 
developer can unlock 
the secrets of the 
Win32 Registry. 



I f USER, Kernel, and GDI are the heart, 
brain, and eyes of Windows, the reg- 
I istry would be the memory— both 
long and short term. OK, maybe this meta- 
phor is a bit weak, but the point should be 
obvious: the registry is a critical compo- 
nent of a well-functioning system and 
you're not going to get very far without it. 

The registry is lightly documented and 
not well understood. Programming it can 
be similar to the old neurological tech- 
niqueof zapping part of thecerebral 
cortex with an electrode and see- 
ing what happens: the patient may 
remember a baseball game or expe- 
rience a war-related flashback. In Windows, 
you may enable a cool new feature or ren- 
der your system unbootable. But it's the 
thrill of the hunt that makes it so exciting. 

After a brief introduction to get our ter- 
minology straight, I'll skip the fundamen- 
tals of the registry— M SDN would be an 
ideal place to find this information— and 
leap into advanced aspects. 

Along the way I'll note a variety of 
thing you can take advantage of immedi- 
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ately: some of them are particular to the 
new Windows shell (first delivered on 
Windows 95 but currently in betaon Win- 
dows NT), some work only with NT (also 
known as "M icrosoft's real operating sys- 
tem"), and some will workfor everybody. 
So, grab your tools (primarily a copy of 
RegEdit) and prepareforanexcitinground 
of hacking the registry. 

The registration database, commonly 
called the registry, contains a substantial 
amount of data about the computer and 
users. It includes computer data such as 
hardware, the OS, and installed applica- 
tions, and user 




information such as their desk- 
top settings and customization prefer- 
ences. T he registry stores data in a hierar- 
chically structured tree. Each node in the 
tree is called a key. Each key can contain 
additional keys called subkeysfseeFigure 
1). Keys are composed of printable char- 
acters and cannot include backslashes 
(\) or wildcard characters (* or ?). Sev- 
eral predefined keys, represented with 
uppercase words separated by under- 
scores, can be accessed using numeric 
constants. These keys are always "open," 
so it's not necessary to use the RegOpen... 
functions on them. It's important to note 
that the root key for machine information 
HKEY_LOCAL_MACHINE(HKEY_CLASSES_ 
ROOT and HKEY_CURRENT_CONFIG map 
to subkeys) and the root key for user infor- 
mation is HKEY USERSfHKEY CURRENT 



USER also maps to asubkey). Keys beneath 
the root are referenced by building a string 
key by concatenating each node together, 
separated by backslashes. 

Each key also contains data stored in 
values: a key may have no values, a de- 
fault value, or any number of named val- 
ues in addition to the default. The data in 
the values may be in a variety of forms, 
though text and binary data types are by 
far the most common. While key names 
and value names are never localized, text 
data often is. Using the Windows 
95 RegEdit utility shows you a 
much compacted view of the regis- 
| try including the root keys, several 
subkeys, a default (text) value, and a 
amed (binary) value (see Figure 2). 
Note that Windows NT has a similar but 
si ightly different structure: it omits HKEY_ 
CURRENT_CONFIGandsubstitutesasome- 
what analogous HKEY_PERFORMANCE_ 
DATA for HKEY_DYN_ DATA. 

SPELUNKING THE REGISTRY 

A variety of common components 
can be found in the registry, 
especially if they haveanything 
to do with OLE. Here are some 
examples so you'll know what you're look- 
ingatwhen you go spelunking with RegEdit. 

Creatable OLE classes, provided by 
OLE servers, must be in the registry. Each 
class is registered separately in the 
HKEY_CLASSES_ROOT\CLSID key under 
its CLSID and must, at minimum, have 
enough information fortheOLE system to 
locate and start the server. For example, 
Access registers the Application object 
with the key name on the left and the 
default value on the right: 

{B54DCF20-5F9C-101B- Microsoft Access Database 

AF4E 00AA003F0F07} 

InprocHandler32 ole32.dll 

LocalServer32 C:\MSOFFICE\ACCESS\MSACCESS.EXE 

ProgID Access. Application. 7 
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Figure l 



Related Entries in the Registry. Expanded (Win95) 
registry keysdepicthow rootkeysmapto majorsubkeys 
for current user, classes, and current configuration. 



OLE controls, being specialized in-process OLE servers, must 
beintheregistry.lfanOLEcontrol isreferenced byan application 
but is not in the registry, it can autoregister itself if the system can 
locate it by searching along the normal DLL search path. 

OLE controls are registered as classes and can also befound 
in the HKEY_CLASSES_ROOT\CLSID key by referencing their 
CLSID. For example, the PicClip control that ships with VB4 has 
the following registry entries: 



{27395F85-0C0C-101B-A3C9-08002B2F49FB} 
Control 

InprocServer32 

Insertable 

MiscStatus 

ProglDPicClip.PictureClip 

ToolboxBitmap32 

TypeLib 

Version 



PicClip Control 



C:\WINDOWS\SYSTEM\PICCLP32.0CX 



C : \WINDOWS\SYSTEM\PICCLP32 . OCX, 1 

{27395F85-0C0C-101B-A3C9-08002B2F49FB} 

1.0 



The Control key is used when dialog boxes like the OLE Insert 
Object dialog or VB4's Custom Controls dialog is displayed with 
the Controls box checked. lnprocServer32 contains the fully 
qualified path to the control. 

ProgID contains theso-called "friendly" name, which can also be 
found in a separate key under HKEY_CLASSES_ROOT: this separate 
key containsa pointer backtotheCLSIDwherealltheinformationfor 
thecontrol is maintained. Thelnsertablekeybehavessimilarlyto the 
Control key, though it may be duplicated under the ProgID key for 
backward compatibility with OLE 1.0 servers. 

Thetypelibraryfor acontrol is indicated in theTypeLib key. 
Type libraries are stored separately in the registry under their 
own GUIDs in the HKEY_CLASSES_ROOT\ TypeLib key. The 
entries for the PicClip control's type library are: 



{27395F85-0C0C-101B-A3C9-08002B2F49FB} 
1.0 

0 

Win32 C:\WINDOWS\SYSTEM\PICCLP32.0CX 

FLAGS 

HELPDIR 



Microsoft PictureClip Control 



2 

C:\VB4 



Note that the type library itself can be stored as a separate 
file on disk (typically with a TLB orOLB extension) or attached 
as a resource to a DLL or EXE. Because OLE controls are in fact 
DLLs, their type libraries are most often stored with the 
control itself. 

The HELPDIR key is notable because it points to the fully 
qualified location for the accompanying WinHelp file containing 
additional programming documentation about the control. This 
location can obviously vary by installation and is typically deter- 
mined when thecontrol isfirst installed : if the Win Help file is moved 
the link can obviously be broken. 

Licenses, such as those used by OLE controls, are also 
commonly stored in the registry. They can befound under the 
HKEY_CLASSES_ROOT\ Licenses key, where you'll also find 
the warning that "Copying the keys may be a violation of 
established copyrights." No kidding. Anyway, each license is 
stored under its own GUID. This example from my registry 
database has both design and run keys (with the key values 
changed, naturally): 



{B54DCF20-5F9C-101B-AF4E-00AA003F0F07} 
Retail 
Runtime 



abcdefghijklmnopqrstuvwxyzabcdefghij 
abedefghi jklmnopqrstuvwxyzabcdefghi j 



VB4 itself uses this technique: when it's installed it merges the 
contents of one of the three REG files (for Standard, Professional, 
and Enterprise editions) into the registry. 

Finally, the registry contains information about remoted OLE 
servers in both their local and remoteconfigurations. Liketheother 
OLE object described here, this VB4-created OLE Automation 
server registers a Clerk class under its own GUID in the 
HKEY_CLASSES_ROOT\ CLSID key. Of course, VB4 handles all the 
registration automatically and it's typically not necessary to modify 
these entries directly. 

RunningtheRemoteAutomation Connection Manager (RacMgr32) 
utility included with VB4Enterprise Edition adds additional keys for 
a remote machine name, RPC protocol, and RPC authentication 
level. When run locally, this particular class is registered as: 



{ 8435CD47-D6BE-11CE-A842- 
_AuthenticationLevel 
JetworkAddress 
JrotocolSequence 
InprocHandler32 
LocalServer32 
ProgID 
TypeLib 



2 

NT 

ncacn_ip_tcp 
OLE32.DLL 

D:\PR0J\MSJ\CAR RENTAL \ RENTAL OBJECTS .EXE 

RentalObjects. Clerk 

{ 8435CD4E-D6EB-11CE-A842-00AA00688747 } 



When the class is remote, RacMgr32 changes the registration 
entries to: 



{ 8435CD47-D6BE-11CE-A842- 
_LocalServer32 
AuthenticationLevel 
InprocHandler32 
InprocServer32 
NetworkAddress 
ProgID 

ProtocolSequence 
TypeLib 



D:\PR0J\MSJ\CAR RENTAL\RENTAL OBJECTS .EXE 
2 

OLE32.DLL 

C:\WINDOWS\SYSTEM\autprx32.dll 
NT 

RentalObjects. Clerk 
ncacn_ip_tcp 

{8435CD4E-D6EB-11CE-A842-00AA00688747} 
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Registry Editor 



Registry Edit View Help 




Subkeys 



My Computer 
jl-Q HKEY_CU9SE9_R00T 
il-Q HKEY_CURRENT_USER 
S O AppE vents 
$"Cj EventLab els 

Control Panel 
_| InstallLocationsMRU 
lil O keyboard layout 
Network 
RennoteAccess 

[j] I Software 

j]-Cj HKEY_LOCAL_MACHINE 
i-Q HKEY_USERS 
+ _| HKEY_CURRENT_CONFIG 
i-Cj HKEY_DYN_DATA 



My Computer\H KE Y_CU R R E N T JJ 9 E R V\ppE vent A9 chemes 



Name 


Data 


*H [Default] 


-►".Current" 


So] ControllniTimeStamp 


0x1ef18e57 (519147095) 


Binary Value 






«l 


I *\ 



Figure 2 



I Keys to the Windows Registry. The hierarchical structure of the registry consists of keys and subkeys. The associated values 
I for each key can be named (text) or a non-string data type (binary). 



Notice how the LocalServer32 key gets renamed (actually, 
keys cannot be renamed, so it is destroyed and re-created) and 
an additional lnprocServer32 key is created. This new key 
points to the remote automation proxy on the local machine, 
initiating a conversation with theAutMgr utility running on the 
remote machine. 

Of course, you'll never want to touch these registration entries 
directly. In addition to using RacMgr32, wecan also call the RacReg 
OLE Automation server in code to examine and change server 
settings. To do so add a reference to the RacReg32.DLL, create a 
RacReg.RegClass object, and use the GetAutoServerSettings func- 
tion and SetAutoServerSettings method. 

Unfortunately, thedocumentation for thesefunctions is a little 
obscure: it's only found in the Read Mefilethat ships with VB4. But 
it's pretty obvious how the RacReg32 server reads/writes the 
registry settings shown in this function prototype: 

object .SetAutoServerSettings (Remote, [ProgID], [CLSID], 
[ServerName] , [Protocol], [Authentication]) 

A side benefit of using the RacReg.RegClass object is that 
Microsoft's VB group promises that your code will be upwardly 
compatible with future versions of VB, which will support true 
Networked OLE: they'll do the workof encapsulating the changes 
so that you don't have to change your code. 

USING REGISTRY FUNCTIONS 

The Win32 API provides a function group of 26 APIs, many of 
them with both "A" (ANSI) and "W" (Wide, or Unicode) ver- 
sions, for working with the registry. Five of the 26 APIs are 



provided for backward compatibility only and shouldn't be 
used (the correspond ing ...Exfunctions, which support named 
values and access to keys other than HKEY_CLASSES_ROOT, 
should be used instead). 

Rather than torture you with a complete list of the APIs, I'll 
point you to a couple of useful samples that highlight their 
implementation such as the RegTool sample that ships on the 
VB4 disc. The RegTool sample is buried down in the \Tools\ 
Dataex32\ Source\ Regtool subdirectory and hasareusableclass 
with routines for creating, updating, and deleting keys. Unfortu- 
nately, while it can read both string and numeric (dword) data, 
it can only write strings. 

A much better examplecanbefound inthefileREGVB4.ZIP in the 
Magazine Library of the VBPJ Forum on CompuServe. Written by 
Don Bradner, VBPJ Forum Section Leader of the "32-Bit Bucket," 
REGVB4 is a handy VB4version of RegEditthat has well-commented 
sourcecodeforreadingand writing both stringand numericvalues. 

Several of the registry functions deserve a bit more com- 
ment. Whilewedo notyethavebuilt-in support for adistributed 
registry (where part or all of your registry is stored on another 
machine), the RegConnectRegistry function can be used pro- 
grammatically to connect to remote registries and get/set val- 
ues from their registries. They can connect only through the 
root keys (HKEY_LOCAL_MACHINE and HKEY_USERS), but be- 
cause of the subkey mappings to HKEY_CURRENT_ 
USER, HKEY_CLASSES_ROOT, and HKEY_CURRENT_CONFIG 
this isn't a major limitation. 

Therearealso a few differences between the Win95 and WinNT 
implementations ofthe registry functions. Of course, Win95 knows 
nothing aboutsecurity, so Get/SetKeySecurity aren't implemented 
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on that platform. Also, while Win95does implement QuerylnfoKey, 
it doesn't track the last write time, so don't be surprised when the 
FILETIM E structure comes up empty. Another thing to watch out 
for, particularly if you develop under Win95, isthat RegDeleteKeyon 
that platform deletes key and descendants, whereas on NT it can 
only delete keys that have no subkeys. 

Because of its architecture, Win95 has very limited support for 
kernel synchronization objects, and thus RegNotifyChangeKeyValue 
is not supported at all. Win95 also doesn't implement 
RegRestoreKey, which can be worked around tediously by writing 
codeto re-create the keys or, much easier, by usinga REGEDIT4file. 

Interestingly, RegQueryMultipleValues is only implemented on 
Win95 (though its primary valueappears to beasacodingshortcut). 
Finally, ifyoumuststoreUnicodedataintheWin95 registryyoumust 
store it as REG_BINARY, because Win95 is an ANSI system. 

It's also worth pointing out that VB4 includes built-in func- 
tions for working with the registry, though they only work with 
information from a specific location in the registry: 

HKEY_CURRENT_USERS\Sof twareWB and VBA Program _ 
Setti ngs\<program name> 

I've seen a number of people experience problems with the 
built-in VB functions. GetSetting and GetA 1 1 Settings are functions, 
but SaveSetting and DeleteSetting are statements and thus don't 
use parentheses. While SaveSetting and DeleteSetting were origi- 
nally specified as functions, later they became statements. 

IMPORT DATA INTO THE REGISTRY 

It's common to use registration (REG) files for importing data 
into the registry. REG files have two formats: REGEDIT and 
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IC^ Exploring - Art 


J Edit View Tools Help 


Open 




t-;. 


Send To ► 


Contents of 'Art' 


New ► 


Folder 
Shortcut 


3... 
3... 
3... 
3... 
A... 
3... 

3... 
3... 
3... 
3... 


Create S hortcut 
Delete 
Rename 
Properties 


Wave Sound 

Microsoft Word Document 

Microsoft Excel Worksheet 

Microsoft PowerPoint Presentation 

Bitmap Image 

TXT 

Visual Basic Project 
Microsoft Office Binder 
Other Office Documents... 
Briefcase 
VISIO 4 Drawing 


Close 




| Finder 

■Cl Msdn 
■Cl reg32 
■Cl RegTool 
■Cl Reskit35 
■Cl SystemDB 


-■Cl Test 


|*f vbp_Ldit.bmp 13KB 


J... 



I9HIIHBI AddingtheTXTFileType to theExplorer. This view of 
UQxl the New menu in the Win95 explorer is fairly typical, 
exceptthat by using the registry, I added theTXT file type to the menu. 
Selecting it launches Notepad, the file associated with TXT files. 



REGEDIT4. REGEDIT4 was introduced to deal with named values. 
RegEditcan run from the command line, but in this configuration, 
it will not beableto load REGEDIT4files. If you're workingon NT, 
you should use the Reglni utility from the NT Resource Kit. 

Continued on page 30. 
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Registry Editor 



Registry Edit View Help 
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I9HRRI AddingtheTestVB Finder to theFind Menu in Explorer. The registry structure for dynamically added Find items illustrates 
UQJlaU how simple it is to add items to the menu. A modified Find Menu in the new shell's Explorer show an entry added by MSN as 
well as two custom entries described here. It's just as easy to add an entry for something like Yahoo for finding files on the Internet. 



Continued from page 26. 

This shows thecontents of a trivial REG file using theold format: 

REGEDIT 

HKEY_CLASSES_ROOT\.txt = txtfile 

And, this shows this new format (with a named value): 

REGEDIT4 

[HKEY_CLASSES_ROOT\.txt] 
©-"txtfile" 

"Content Type"="text/pl ai n" 

If you distribute a REG file with your application, be aware 
that Setup Toolkit has somewhat limited support for this. You 
can add a REG file with the Add Files button and the Setup 
Toolkit will register those keys on the user's machine. However, 
you are limited to embedding relative paths and there's no 
automated support for uninstalling the REG file entries. 

If you've been following along on your machine, your registry 
might be getting a little wonky. It's not uncommon for your 
registry to getwhacked: hacking around manually justtends to 
accelerate this process. Eventually, you're going to want to use 
the little-known RegClean utility (16- and 32-bit) that ships with 
VB4 and is located in the \Tools\PSS subdirectory. It can 
correct a number of these problems in your registry: 

• Mismatched GUID in TypeLib. 

• Missing TypeLib GUID. 

• Missing CLSID for ProglD. 

• Useless NumMethods or Baselnterface keys. 



• Invalid ProglD key. 

• Missing OLE key. 

• Wrong value for OLE key. 

• Missing file. 

• Empty subkey. 

• Conflicting local/remote keys. 

• Improper InprocServer registration. 

• Server isn't AUTPRX16.DLL/AUTPRX32.DLL. 

• Differing server paths. 

• Missing InprocServer key. 

RegClean also gives you the option of creating a pending change 
file or just letting it rip and make the changes for you (guess 
which one I chose). 

EXTENDING THE NEW SHELL 

If you've selected New from the File menu within the Windows 
95 Explorer, after what seems like an inordinate delay you've 
seen a cascading menu (see Figure 3). 

The shell is searching through the registry looking for valid 
file extensions (those beginning with ".") that have a subkey of 
ShellNew. Each time it finds one, it reads the value in the 
extension's key to determine the ProglD, looks up the ProglD, 
and adds the value of that key to the menu. 

For example, to add the TXT item to the menu shown in 
Figure 3, 1 added the ShellNew key to the CLSID key for ".txt" 
files: 



HKEY_CLASSES_ROOT\ . txt = txtfile 
ShellNew 



CONTINUED ON PAGE 34. 
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Dim CRLF As String 

Dim QT As String 

Dim sFile As String 

For x = 1 To Len(txtFile) 'Double \\ 

If Mid$(txtFile, x, 1) = "\" Then sFile = _ 
sFile & "\" 

sFile = sFile & Mi d$ ( txt Fi 1 e , x, 1) 
Next x 

CRLF = Chr$(13) & Chr$(10) 
QT = Chr$(34) 
txtScript = "" 
txtScript = "REGEDIT4" 

txtScript = txtScript & CRLF & "[HKEY_LOCAL_MACHINE\_ 

SOFTWAREXMi crosof t\Wi ndows\ Cur rent Vers i on\expl orer\_ 
Fi ndExtensi ons\Stati c\" & txtShort & "]" 
txtScript = txtScript & CRLF & "@=" & QT & 
txtGUID & QT 

txtScript = txtScript & CRLF & "[HKEY_LOCAL_MACHINE\_ 
SOFTWAREXMi crosoft\Wi ndows\ Cur rent Vers i on\_ 
expl orer\Fi ndExtensi ons\Stati c\" & txtShort & _ 
"\0]" 

txtScript = txtScript & CRLF & "@=" & QT & 

txtDescri pti on & QT 
txtScript = txtScript & CRLF & "[HKEY_LOCAL_MACHINE\_ 

SOFTWAREXMi crosof t\Wi ndows\ Cur rent Vers i on\_ 

expl orer\Fi ndExtensi ons\Stati c\" & txtShort & _ 

"\0\Defaul tlcon]" 
txtScript = txtScript & CRLF & "@=" & QT & sFile & 

",0" & QT 
txtScript = txtScript & CRLF 
txtScript = txtScript & CRLF & 

"[HKEY_CLASSES_ROOT\CLSID\" _ 

& txtGUID & "\FindCmd]" 
txtScript = txtScript & CRLF & "@=" & QT & sFile & QT 
txtScript = txtScript & CRLF & _ 

"[HKEY_CLASSES_ROOT\CLSID\" _ 

& txtGUID & "\InprocServer32] M 
txtScript = txtScript & CRLF & "@=" & QT & _ 

"FindExt.dll" & QT 
txtScript = txtScript & CRLF & QT & 

"ThreadingModel " & QT _ 

& "=" & QT & "Apartment" & QT 
txtScript = txtScript & CRLF 



nRffifl REGEDIT4 Script Generation. This script is pretty 
lifiUUU standard string manipulation code, with one exception. 
Note the required doubled backslashes and trailing blank line. 



which, when accessed by the shell, was translated into the: 

HKEY_CLASSES_ROOT\txtf ile = TXT 

Of course, the point of this isn't that you can launch Notepad 
(though that is somewhat useful), but that you add your 
program to the New item from your users File menu with very 
little effort. 

The shell can be extended in many other ways. For example, 
you can add a destination application to the Send To menu for all 
Explorer items by placing a shortcut to the destination applica- 
tion in the \Windows\SendTo folder. I suggest you create a 
shortcut in the \Windows\SendTo directory for RegSvr32.EXE. 
Heck, you don't even have to run RegEdit to do this one. 

You may have clicked on files in the shell that don't have 
any extension: the resulting dialog is annoying but at least you 
can associate the file with a particular application. Unfortu- 
nately, that association doesn't "stick" and you have to do this 
every time. Files without an extension are of class "." and you 
must manually add this type to the registry. You can either add 
a single key that points to whatever (for instance) a "txtfile" 
might be: 
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HKEY_CLASSS_ROOT\. = "txtfile" 

or you can enter your own class as in this example: 

HKEY_CLASSS_ROOT\. = "none" 
HKEY_CLASSS_ROOT\none\DefaultIcon = "notepad, 1" 
HKEY_CLASSS_ROOT\none\shell\open\command = "notepad.exe "II."" 

If you just want to add a single menu command to the context 
menu of a specific file type, you can use a similar technique 
method: these two entries will add an Edit menu item to VB 
project (VBP) files and load them into Notepad: 

HKEY_CLASSS_ROOT\VisualBasic.Project\shell\Edit = "" 

HKEY_CLASSS_ROOT\VisualBasic.Project\shell\Edit\command = "notepad.exe "U."" 

EXTENDING THE FIND MENU 

The new shell can be extended in a number of ways using, not 
surprisingly, a mechanism called shell extensions. Shell exten- 
sionsareimplemented asspecialized DLLsthatcreateOLECOM 
objects and support specific OLE interfaces. One example is the 
built-in "Files or Folders..." and "Computer..." menu items found 
on the Find submenu. While it's possible to add to this menu, 
just as MSN does with the "On The Microsoft Network..." item, 
shell extensions cannot currently be written in VB. 

Fortunately, J eff Richter has written a custom FindExt.DLL 
that encapsulates the necessary functionality and allows at- 
tachment of any program to the Find submenu (see Figure 4). 
You generate custom CLSIDs that point to this DLL: when one is 
invoked, the DLL looks up the associated command line and 
executes it. This compiled DLL is included with thesamplecode 
for this article available on VBPJ 's Development Exchange on 
CompuServe (GO WINDX), The M icrosoft Network (GO WINDX) 
and the World Wide Web (http://www.windx.com) and can be 
freely distributed. Richter will be writing about and publishing 
the source code later this year. 

Extensions to the Find submenu are stored in the registry, 
buried in the HKEY_LOCAL_M ACHINE\ SOFTWARE\ 
Microsoft\Windows\CurrentVersion\explorer\ 
FindExtensionssubkey. Extensions stored atthat level are loaded 
automatically when the Explorer is first loaded (normally the 
shell boots when Windows 95 is first loaded). The Static subkey 
beneath that contains extensions that are loaded dynamically: 
they are invoked when the user selects the item on the Find 
submenu. This is where you should put your custom find utilities. 

To do so you need to create three additional nested subkeys: 
the extension that points to the CLSID of the InProc server, the 
menu text, and the menu icon. The first item to add is the 
extension that points to the CLSID of the InProc OLE server. 

The name of this key (InetFind, MSNFind, and VBFind in the 
figure) is unimportant: Windows never displays it and the 
submenu items are actually drawn from the registry in the order 
they were added, notalphabetically.Thevalueof this key isthe 
text version of a CLSID that points to FindExt.DLL, in this case. 
Next, add the menu text itself (including an accelerator key if 
desired). The name of this key must be "0." 

Finally, add the icon to bedisplayed in the menu, which has 
a value that includes the file name of the executable and the 
index of the icon (typically zero) to be used. The name of this key 
must be "Defaultlcon." 

To see the new menu item, it's necessary to restart the 
Explorer. You can either restart Windows 95, which is slow and 
inconvenient, particularly if you have multiple applications 
open, or you can shutdown and restart the shell. To shutdown 
the shell, choose "Shutdown" from the Start menu and, when 
you see the "Shut Down Windows" dialog box, hold down the 

CONTINUED ON PAGE 38. 
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IVB4I 

Declare Function RegNoti fyChangeKeyVal ue Lib _ 
"advapi32.dll" 

(ByVal hKey As Long, ByVal bWatchSubtree As Long, 
ByVal dwNoti fyFi 1 ter As Long, ByVal hEvent As Long, _ 
ByVal fAsynchronus As Long) As Long 
Declare Function Wai tForSi ngl eObject Lib "kernel32" _ 
(ByVal hHandle As Long, ByVal dwMi 1 1 i seconds As _ 
Long) As Long 

Declare Function CreateEvent Lib "kernel32" Alias _ 
"CreateEventA" ( 1 pEventAttri butes As Long, ByVal _ 
bManualReset As Long, ByVal blni ti al State As Long, 
ByVal lpName As String) As Long 
Declare Function CloseHandle Lib "kernel32" (ByVal _ 

hObject As Long) As Long 
Public Const HKEY_CLASSES_ROOT = &H80000000 
Public Const REG_N0TI FY_CHANGE_ATTRIBUTES = &H2 
Public Const REG_N0TI FY_CHANGE_LAST_SET = &H4 
Public Const REG_N0TI FY_CHANGE_NAME = &H1 
Public Const REG_N0TI FY_CHANGE_SECURITY = &H8 

Private Sub cmdRegi stry_Cl i ck( ) 
Dim IChange As Long 

mhEvent = CreateEvent(0&, False, False, vbNul 1 Stri ng ) 

IChange = RegNoti fyChangeKeyVal ue_ 
(HKEY_CLASSES_ROOT, True, 
REG_NOTIFY_CHANGE_NAME, mhEvent, True) 

tmrRegistry . Enabl ed = True 

Me. Caption = "Waiting for registry change..." 
End Sub 

Private Sub tmrRegi stry_Timer( ) 
Static ISignal As Long 
Stati c 1 Resul t As Long 

ISignal = Wai tForSi ngl eObject (mhEvent , 0&) 
If ISignal = 0 Then 

Me. Caption = "Registry Changed" 

tmeRegi stry. Enabl ed = False 

IResult = CI oseHandl e(mhEvent ) 
End If 

End Sub 



|IH!|ffin Declarations and Code for Handling Registry 
ISHIIUXI ChangeNotification.ThecmdRegistry_Click subroutine 
creates the event object, passes its handle to the system signalling 
when the registry changes, and starts the polling timer. Details about 
Registry Change Notification messages are shown in Table 1. 



Ctrl-Alt-Shift key combination and click on the "No" button. This 
leaves you in something like the old shell, where pressing Ctrl- 
Escape brings up theTask Manager, from which you can select 
"Run" from the File menu and restart Explorer. 

Although the menu item is visible at this point, it won't 
actually do anything. To make it work, you must add the CLSID 
to the HKEY_CLASSES_ROOT\ CLSID key and create a couple of 
additional subkeys: the CLSID of the OLE InProc server refer- 
enced by the Find extension, the command line to be executed 
by FindExt.DLL, which must be stored under the FindCmd key, 
and finally the lnprocServer32 key with two values. The first, 
which is the default, contains the path (if appropriate) and file 
name of the FindExt.DLL, which will typically be located in the 
\Windows\ System subdirectory. 

The second key, "ThreadingModel," should be set to "Apart- 
ment" becausethe FindExt.DLL uses that mechanism and is, in fact, 
thread safe. The threading model applies only to OLE Servers that 
are loading in process. The steps I've outlined area bit tedious, yet 
they must be carried out exactly for this to work properly. To ease 
the procedure, I wrote a small Finder Installation utility that 
automates the whole process (available for download from the 
online services described elsewhere in this article). 
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The first step in using this utility is to generate a new CLSID, 
which isequivalentto aGUID (for"Globally UniquelD"in Microsoft 
terminology) or UUID (for "Universally Unique ID," in DCE/RPC 
terminology). 

VB creates GU IDs for us automatically when we create OLE 
Servers, and the GUIDGen utility included in the Win32 SDK 
can be used to generate them manually. Anyway, I want to 
create a CLSID programmatically so I need to create a GUID 
structure and fill it in by calling the OLE function CoCreateGuid, 
which in turn calls the RPC function UuidCreate. 

The Win32 documentation states that UuidCreate is not 
implemented on Windows 95, but that isn't true: it can be 
found in RPCRT4.DLL. 

The Win32 header files give this structure for a GUID: 

typedef struct _GUID { // size is 16 

DWORD Datal; 

WORD Data2; 

WORD Data3; 

BYTE Data4[8]; 
} GUID; 

which I translated into this VB code: 

Type tGUID 

PI As Long 

P2 As Integer 

P3 As Integer 

P4 As Byte 

P5 As Byte 

P6 As Byte 

P7 As Byte 

P8 As Byte 

P9 As Byte 

P10 As Byte 

Pll As Byte 
End Type 

The CoCreateGuid declaration was pretty obvious: 

Declare Function CoCreateGuid Lib _ 
"0LE32.DLL" (guid As tGUID) As Long 

Calling it is dead simple: 

Dim tmp As tGUID 

IRet = CoCreateGuid(tmp) 

Unfortunately, the GUID you end up with is binary. You need 
a string in this format: "{xxxxxxxx-xxxx-xxxx-xxxx- 
xxxxxxxxxxxx}". The Win32 API does provide a UuidToString 
function located in RPCRT4.DLL and the Win32 SDK header files 
provides this prototype: 

Uui dToStri ngA ( 

IN UUID _RPC_FAR * Uuid, 
OUT unsigned char _RPC_FAR * _RPC_FAR _ 
* StringUuid 

); 

But, it turns out that this function isn't callable from VB. 
However, another function, StringFromGUID2, gets us on the 
right track using this declaration: 

Declare Function Stri ngFromGUID2 Lib _ 

"0LE32.DLL" (guid As tGUID, IpszString As _ 
Byte, IMax As Long) As Long 



http://www.windx.com 



©1991-1996 Fawcette Technical Publications 



HACKING TH 



E REGISTRY | 



MESSAGE 


DESCRIPTION 


REG_ 


NOTI FY_ CHANGE_ NAM E 


Changes to key names that occur in the specified 
key or in the specified key and its subkeys cause 
a change notification. This includes key creations 
and deletions. 


REG_ 


NOTIFY_CHANGE_ ATTRIBUTES 


Attribute changes that occur in a key or in a key 
and its subkeys cause a change notification. 


REG_ 


NOTI FY_ CHANGE_ LAST_ SET 


Changes to the last write time that occur in a key 
or in a key and its subkeys cause a change 
notification. 


REG_ 


NOTIFY_CHANGE_ SECURITY 


Security-descriptor changes that occur in a key or in 
a key and its subkeys cause a change notification. 



BJPRH What'sChanged?Registrychangenotification messages, 
miliU and theirdescriptions. Be aware thatsome messages that 
exist on Windows NT aren't supported by Windows 95. 



Calling this function and putting the result into the Text 
control is a piece of cake: 

Dim bBuff(256) As Byte 

!Ret2 = StringFromGUID2(tmp, bBuff(O), 256&) 
txtGUID = bBuff 

Thesethree lines ofcodearedoingalot.Thecontents of the bBuff 
byte array are actually a Unicode string. If you examine it in detail, 
you'll see that every element contains the ASCII valueof a character 
that you want in the string version. Assigning the contents of the 
buffer to a string (or, in this case, thetext property of aText control) 
converts it correctly because VB4 strings are internally Unicode. 

Thesecond and third steps areto simply fill in theextension 
key name (which is not used), menu text, and complete com- 
mand line that we wish to execute. 

Thefourth step istogenerateacompleteREGEDIT4scriptthat 
contains all of the entries in the appropriate format. This is 
straightforward VB string manipulation code (see Listing 1) with 
these caveats: any key value containing a backslash character 
must be doubled and the script must have a blank line at the end 
for the previous line to be registered correctly. The last step is to 
copy this script into a REG file and execute it from the shell. 

Again, because you create your own CLSID,you can have any 
number of Find extensions on a system without worrying about 
colliding with one written and installed by someone else. Be- 
cause the FindExt.DLL is internally calling the new Win32 
ShellExecute function, you can even substitute the executable 
file name with something like this: 

http : //www. yahoo . com 

You might associate this with the menu description "On The 
^Internet... ."Choosing this automatically brings up the Internet 
Explorer, logs you on to the Internet, and take you to the Yahoo 
finder. Other ideas for Find extensions might include a com- 
pany-wide address book, a shortcut to MSDN, or virtually any- 
thing else that makes sense to you. 

DIFFERENCES BETWEEN NT AND 95 

As developers are all too painfully aware, there are major 
differences between the Windows 95 and Windows NT plat- 
forms. Some of these differences will disappear over time: the 
NT Shell Update Release (SUR) will add the new shell, TAPI 
support, and so on, while some of the most glaring differences, 
like Windows 95's lack of security, will remain. One of the gray 
areas is support for theWin32 Kernel synchronization objects: 
while support for the file change notifications is supported 
through the FindXXXChangeNotification family of APIs on both 
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platforms, support for registry change notifications (through 
RegNotifyChangeKeyValue) is supported only on NT. 

Whileafull discussion of kernel synchronization objects— such 
as mailslots, processes, threads, mutexes, events, semaphores, file 
handles, file mappings, named pipes— will have to wait until an- 
other time, I'll cover only registry synchronization for now. 

Kernel event objects can exist in either a signaled or not- 
signaled state. Basically, we create an event object, tell the 
system to signal that object when the registry changes, and wait 
for the object to get signaled. Normally this is done synchro- 
nously by suspendingthecallingthread until thesignal occurs. 

Unfortunately, because VB apps can currently use only a 
single thread, this would have the effect of hanging the entire 
app until the change occurs. Freezing an application is consid- 
ered to be sub-optimal from an implementation standpoint 
(users generally don't like this), so I programmed around this 
limitation using a Timer and periodically checking the state of 
the event. While polling is usually a sign of a bad application 
architecture, in this case there's no other choice. 

To illustrate this, I created a small testing application that's 
easy to follow (see Listing 2). The code starts in the 
cmdRegistry_Click subroutine, which creates the event object, 
passes its handle to the system to get signaled when the registry 
changes, and starts the polling timer. The timer calls 
WaitForSingleObject (with a time of 0 milliseconds) and returns 
immediately. 

When the event gets signaled, the timer is disabled and the 
event object is destroyed by closing its handle. This particular 
example looks for changes to key names at the root level of 
HKEY_CLASSES_ROOT and includes subkeys: it's probably the 
most useful, although you may want to examine the other 
options from the Win32 SDK (see Table 1). 

As a final reminder, since the RegNotifyChangeKeyValue 
function is implemented only on Windows NT, this tester won't 
do anything on Windows 95. 

Here are some useful tips. First, any longfile names stored in 
the registry should be enclosed in quotes, like this: 

shell\open\command = "C:\Program Files\My Accessories\WinWord.Exe" U 

Alternately, the short file name could be stored so it will workon 
allsystems.Anexampleofthisisthesystem-suppliedFindutilitythat 
supplies the "Files or Folders..." and "Computer..." menu items: 

C:\Progra~l\TheMic~l\findstub.dll 

While type and size of data you can store in the registry is 
relatively unlimited, in general you should not store frequently 
accessed data in the registry. Registry access is much slower than 
shared memory and even slowerthanfileaccess. You should also 
be aware that named values consume less space than keys 
consume. You might also consider packing data together into a 
structure and storing the entire structure as a single binary value. 

If your application is adding more than a couple of kilobytes 
to the registry, consider storing a pointer to that data and 
locating it elsewhere, either as a file or perhaps as a type library. 

Also, while it's certainly possible, Microsoft strongly encour- 
ages developers not to store binary, executable programs in the 
registry. If you're still interested in the registry and are looking 
for a place to jump in where you're likely to see familiar stuff, I'll 
leave you with these keys as "suggested reading:" 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls 
HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\SessionManager\KnownDLLs 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping 
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows\CurrentVersion\AppPaths 
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall *J 
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